arXiv subjects

Xiaoqing Ding

Publications and source records attributed to Xiaoqing Ding.

3 recordsLinked to original sources

arXiv2026

LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agents

Privileged language-model agents can satisfy a new system task by displacing a healthy incumbent that depends on the same file, process, socket, lock, or capacity allocation. This failure arises because execution privilege determines whether an operation can run, not whether the requester may preempt the current resource owner. We present LeaseGuard, a deterministic admission layer that represents preemption authority through canonical resource leases, incumbent-health checks, effect-aware admission, coexistence limits, safe alternatives, and resource-scoped overrides before adapter execution. We evaluate it on a frozen benchmark of 60 newly authored conflict scenarios with matched controls across two local model families. Relative to a preservation prompt, LeaseGuard reduces unauthorized preemption from 73.3% to 0.0% and increases safe completion by 70.0 percentage points (scenario-clustered 95% CI [60.8, 79.2]). Requested-task success changes by -3.3 points (95% CI [-9.2, 2.5]). The fully evaluated v0.2 broker also rejects a forged incumbent task identity in a hash-linked stress audit. Expiry-only reclamation can still expose a healthy incumbent after missed renewal. The evidence supports incumbent-preserving admission when effects are completely mediated, task ownership is authenticated, and lease expiry reflects incumbent liveness.

cs.CR↗

arXiv2026

Residual Community Prototypes Under-Reject Held-Out Malware Families in FCG-MFD

Open-set malware-family recognition must classify known families while rejecting families absent from training. We test whether Louvain-community summaries add rejection information beyond a graph neural network embedding and dimension-matched generic topology. The study uses a deduplicated, conflict-audited FCG-MFD corpus, five held-out families, and three optimization seeds. Community features are residualized against generic topology using known-family training data before nearest-prototype scoring. Residual community does not produce stable held-out-family rejection. Ranking effects reverse across families, the false-positive rate at 95 percent unknown recall worsens for every held-out family, and a validation-fitted threshold rejects only 4.48 percent of unknown samples. Accepted-known macro F1 improves in every family, but with five independent family units the exact two-sided sign-flip p-value is 0.0625, the smallest attainable value. The score remains associated with graph scale, while simple classifier uncertainty performs better on ranking, high-recall rejection, and OSCR. In this GIN/FCG-MFD setting, community-enriched prototypes change known-class geometry without creating a stable unknown margin. Graph open-set evaluations should pair structural features with matched topology controls, operational thresholds, and held-out-family analysis.

cs.CR↗

arXiv2026

Partition-Matched Evaluation of Community Features under Distribution Shift in Android Malware Function-Call Graphs

Graph-based Android malware classifiers can lose accuracy under malware-type or family shifts. We test whether mesoscopic organization in function-call graphs provides shift-stable information beyond local degree profiles (LDP), global statistics, lightweight metadata, and size-matched random partitions. Using 15,000 MalNet-Tiny, Common, and Distinct graphs, six Leiden descriptors specified before evaluation, and five optimizer seeds, communities raise Tiny macro F1 from 78.7% to 81.3% but yield 29.4-point source-only Common degradation. One size-matched random partition yields 27.8-point degradation. Across five random partitions, mean degradation is 27.9 points; the 95% two-level bootstrap interval for random minus community degradation is [-4.2, 1.2] points. With metadata, the corresponding difference is -0.2 points with interval [-1.1, 0.6]. Removing modularity raises structure-only Common macro F1 from 51.9% to 53.6%. The tested signature adds IID signal but shows no repeatable shift-stability advantage, demonstrating why mesoscopic graph claims need partition-matched controls and repeated null draws.

cs.CR↗